One-Time Password Authentication via Dynamic Counter and Intermediary Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
PIN-based systems for authentication are vulnerable to interception and compromise, particularly in card-not-present transactions, as they rely on static PINs that can be compromised, leading to potential fraud and brute force attacks.
Innovation Solution
A method using one-time passwords (OTPs) is implemented, where a user generates or receives an OTP, which is authenticated by an authentication server, and used in combination with an account number for transaction authorization, ensuring secure communication and verification through challenge signing and decryption processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If static PINs are used for authentication, then the authentication process is simple and fast, but the system becomes vulnerable to interception, compromise, and brute force attacks
Solution Approach 1:
The patent transforms the static PIN into a dynamic one-time password (OTP) that changes with each transaction. The OTP is generated based on a secret key and a counter value that increments with each use, ensuring that each password is unique and valid for only one transaction. This dynamic approach maintains ease of operation while significantly improving system security by preventing replay attacks and brute force attacks.
Solution Approach 2:
The patent changes the parameter of the password from static to dynamic by introducing a counter value that increments with each transaction. The OTP is generated as a function of the secret key and the counter value, ensuring that each password is unique. This parameter change allows the system to maintain simplicity while enhancing security, as each OTP is valid for only one transaction and cannot be reused.
2Reliability
If one-time passwords are implemented, then transaction security is enhanced, but the system complexity increases due to authentication servers and challenge signing processes
Solution Approach 1:
The patent introduces an authentication server as an intermediary between the user and the transaction system. The authentication server stores secret keys, generates OTPs, and verifies them during transactions. This intermediary approach enhances transaction security by centralizing the authentication logic and ensuring that each OTP is unique and valid for only one transaction, while managing the increased system complexity through a dedicated security component.
3Object-affected harmful factors
If OTPs are used instead of static PINs, then future fraud risk is reduced, but the ease of operation decreases due to additional authentication steps
Solution Approach 1:
The patent implements a self-service mechanism where the user's device automatically generates and manages OTPs using a stored secret key and counter value. The device can autonomously create unique passwords for each transaction without requiring manual intervention or complex user actions. This self-service approach reduces fraud risk by ensuring each OTP is unique and valid for only one transaction, while maintaining ease of operation by automating the authentication process.
Data Source
AI summary
According to the invention, a method of using a one-time password for a transaction between a user and a merchant is disclosed. The method may include generating the one-time password. The method may also include authenticating the user by the authentication server in response to a request from the user to use the one-time password. The method may further include authorizing the use of the one-time password for the transaction in response to authenticating the user by the authentication server. The method may moreover include using the one-time password in combination with an account number to settle the transaction between the user and the merchant. The method may additionally include sending a message to the authentication server originating from the merchant, wherein the message comprises the one-time password, and wherein the message requests a determination whether the one-time password is authorized for use in the transaction. The method may also include sending a message to the merchant originating from the authentication server, wherein the message includes a determination whether the transaction should be approved in response to the authentication server determining whether the one-time password is authorized for use in the transaction.